JP2015115878A - Portable terminal setting method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide high security for a portable terminal setting method which uses NFC communication functions with a portable terminal setting tag.SOLUTION: A portable setting method includes the steps of: performing authentication between a portable terminal setting tag and a portable terminal by using a terminal ID identifying the portable terminal as an authentication element; and when the authentication is successful, reading out setting information from the portable terminal setting tag and setting the portable terminal on the basis of the setting information. The terminal ID as an authentication element is encrypted using a variable encryption parameter, or the terminal ID as an authentication element is encrypted after being processed with a variable.

Description

  The present invention relates to a mobile terminal setting method, and more particularly, to a method for setting a mobile terminal by communicating with a non-contact IC that stores setting information.

Conventionally, in a mobile terminal such as a smartphone (multi-function mobile phone) having a communication function by NFC (Near Field Communication), the setting contents of the mobile terminal (the time for an alarm to be switched from 3G / LTE to WiFi) Set to an NFC tag (a non-contact IC having a communication unit and a storage unit that communicates by NFC) in advance, and when the portable terminal is held over the NFC tag, the content set in the NFC tag is read in advance. An application to be set in a mobile terminal is provided. (See Non-Patent Document 1)
FIG. 1 shows a flow of setting a mobile terminal using an NFC tag by a conventional mobile terminal setting application. Table 1 shows an example of a file stored in the storage unit of the non-contact IC constituting the NFC tag. As shown in Table 1, in the file, for example, the volume of the mobile terminal, the time when the alarm is generated, and the setting contents for selecting the communication method can be stored in advance.

  Referring to FIG. 1, in step S203, the mobile terminal setting application is activated in the mobile terminal. The mobile terminal setting application communicates with the non-contact IC through subsequent steps, reads the parameters in the file stored in the storage unit of the non-contact IC, and stores the read parameters in the storage unit of the mobile terminal This is an application that sets the mobile terminal or activates another application of the mobile terminal using the read parameter.

  In step S205, the mobile terminal starts detecting a non-contact IC for setting the mobile terminal (starts detecting an NFC tag including the non-contact IC in which the setting file is stored).

  If a non-contact IC is detected in step S207, it is determined in step S209 whether the mobile terminal is a mobile terminal setting non-contact IC based on the contents of the file stored in the non-contact IC.

  When a non-contact IC is not detected (S207) or when it is determined that the contactless IC is not a mobile terminal setting non-contact IC (S209), the process returns to step S205, and detection of the mobile terminal setting non-contact IC is continued.

  In step S211, the mobile terminal reads the parameters stored in the mobile terminal setting non-contact IC.

  In step S213, the mobile terminal sets the mobile terminal by storing the read parameter in the mobile terminal, or activates another application of the mobile terminal using the read parameter.

“NFC Task Launcher“ NFC Task Launcher ””, Internet <URL: http://andronavi.com/2013/05/267599>

  However, no security is applied to the NFC tag for mobile terminal setting as described above. Since there is no security function between the NFC tag and the mobile terminal, the contents of malicious settings are stored in the NFC tag for setting, and the person who holds the mobile terminal over the mobile terminal It is possible to make inconvenient settings for the person himself without being noticed. For example, a mail application may be activated to send an unintended mail to a malicious site, and personal information such as a mail address may be illegally acquired.

  In order to solve this, it is necessary to provide security such as authentication between the NFC tag (non-contact IC) and the mobile terminal setting application.

  The present invention has been made in view of such a problem, and an object of the present invention is to provide an authentication function between a non-contact IC for setting a mobile terminal and a mobile terminal, and authentication is not successful. Is to provide a security function between the portable terminal and the non-contact IC for setting the portable terminal so that the portable terminal is not set to be stored in the non-contact IC.

  In order to achieve such an object, a mobile terminal setting method according to an aspect of the present invention includes a mobile terminal such as a MAC address, a terminal number, and a SIM ICCID (IC Card IDentifier) or IMSI (International Mobile Subscriber Identity). Is used as a component for authentication between the mobile terminal setting non-contact IC and the mobile terminal.

  In one embodiment, when the contactless IC that stores the setting information of the mobile terminal is a card that does not have an authentication function by a processor or an encryption device, the mobile terminal setting method writes the encrypted terminal ID to the contactless IC. The encryption parameters used for encryption are also written in the non-contact IC. By changing the encryption parameter each time, eavesdropping of the encryption parameter is prevented. By authenticating with the mobile terminal that the correctly encrypted terminal ID is written in the non-contact IC, it is determined that the terminal ID is a valid non-contact IC for mobile terminal setting, and the setting parameters of the mobile terminal are not Read from the contact IC to change the setting of the mobile terminal, start an application, and the like.

  In one embodiment, when the contactless IC that stores the setting information of the mobile terminal has a processor, an encryption device, or the like, the contactless IC decrypts the encrypted information received from the mobile terminal. The non-contact IC processes the terminal ID using information based on the decrypted information and then encrypts and transmits it to the mobile terminal. The mobile terminal decrypts this and processes the decrypted information. Authenticate.

  In one embodiment, the contactless IC for mobile terminal setting stores setting information of a plurality of mobile terminals. In the non-contact IC storage unit, an area for each terminal ID or ICCID is provided, and setting parameters for each mobile terminal are stored in each area, so that each non-contact IC is different for each mobile terminal. It is also possible to implement settings. Further, by performing group designation or range designation of terminal IDs, it is possible to perform the same setting for portable terminals having a certain range of terminal IDs or grouped portable terminals.

  As described above, according to the present invention, a security function is provided between a non-contact IC for setting a mobile terminal and the mobile terminal. If authentication is successful by the security function, the security function is stored in the non-contact IC. The mobile terminal can be set according to the parameters that are set, and if the authentication is not successful, the mobile terminal is not set.

It is a figure which shows the flow of the setting method of the portable terminal using the NFC tag (non-contact IC) by the conventional portable terminal setting application. It is a figure which shows schematic structure of the portable terminal concerning one Embodiment of this invention. It is a figure which shows the flow of the setting method of the portable terminal using non-contact IC by the portable terminal setting application concerning one Embodiment of this invention. It is a figure which shows the flow of the setting method of the portable terminal using non-contact IC by the portable terminal setting application concerning one Embodiment of this invention. It is a figure which shows the flow which writes the setting parameter of a portable terminal in non-contact IC.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In this specification, a mobile terminal includes a smart phone, a multi-function mobile phone, a mobile phone, a personal information terminal, a PDA, and the like. The non-contact IC is a component of a non-contact IC tag and a non-contact IC card.

  FIG. 2 shows a schematic configuration of a portable terminal 100 and a schematic configuration of a non-contact IC that can implement the portable terminal setting method according to the embodiment of the present invention. The portable terminal 100 includes a read / write unit 104, a storage unit 106, an operation unit 108, and a wireless communication unit 114, which are connected to the processor 102, respectively. The mobile terminal 100 is equipped with a SIM 103 and stores an ICCID (IC Card IDentifier), an IMSI (International Mobile Subscriber Identity), and the like. The processor 102 is connected to the SIM 103 and can read the terminal ID. The mobile terminal 100 also includes a microphone and a speaker (not shown).

  The wireless communication unit 114 includes an antenna 116 and can communicate with other portable terminals via the wireless network 150. The wireless network may be a mobile phone network such as 3G / LTE or a wireless LAN such as IEEE 802.11x. The mobile terminal 100 can communicate by switching between two or more wireless networks.

  The operation unit 108 includes an input unit 110 such as a keypad and a display unit 112 such as a display. The display may be a touch display.

  The read / write unit 104 communicates with the communication unit 204 of the non-contact IC 202 by NFC (Near Field Communication) to read / write data from / to the storage unit 206.

  The storage unit 106 stores a plurality of application programs 1 to n executed by the mobile terminal 100 and setting information 1 to n thereof. At least a part of the setting information stored in the storage unit 106 may be the setting information read from the storage unit 206 of the non-contact IC.

  The mobile terminal setting application can be one of application programs stored in the storage unit 106. It is desirable that the mobile terminal setting application should be written in an area where it cannot be read without a password by providing protection such as obfuscation and compiling.

  The processor 102 reads the application program from the storage unit 106 to a RAM (not shown) and executes it. The processor 102 reads setting information necessary for executing the application program from the storage unit 106 or the storage unit 206 of the non-contact IC 202 to a RAM (not shown). Further, the processor 102 executes a mobile terminal setting application.

  In FIG. 2, the non-contact IC 202 is shown in the form of a non-contact IC card 200, but may be in the form of a non-contact IC tag (NFC tag). The contactless IC 202 may include a processor or encryption device 208.

  The mobile terminal setting method according to the embodiment of the present invention uses a terminal ID that identifies the mobile terminal 100. A unique ID such as a terminal number of a normal mobile terminal or an ICCID of a SIM can be used as a terminal ID. The terminal ID may be any information as long as the mobile terminal 100 can be specified. For example, when downloading / installing a mobile terminal setting application, a unique ID is acquired, numbered, assigned, and stored in the storage unit 106 of the mobile terminal 100, and this unique ID is used as a terminal ID. Also good.

(Embodiment 1)
With reference to FIG. 3, the portable terminal setting method according to the first embodiment will be described. In this embodiment, it is assumed that the non-contact IC 202 does not include the processor or the encryption device 208. However, even if the non-contact IC 202 includes the processor or the encryption device 208, the method of this embodiment can be performed. it can. The storage unit 206 of the non-contact IC 202 stores files shown in Table 2 in advance. As shown in Table 2, the file contains authentication information (encrypted terminal ID) and encryption parameters (encrypted terminal ID) used for authentication between the portable terminal 100 and the non-contact IC 204. Stored random number).

  As a method for encrypting the terminal ID, any one of a common key cryptosystem such as DES and AES, a public key cryptosystem such as RSA, and a hash function represented by SHA-1 may be used. The portable terminal setting application implements a corresponding decryption method and can decrypt the encrypted terminal ID.

  Similarly to the example shown in Table 1, in the file of Table 2, for example, the volume of the portable terminal, the time when the alarm is generated, and the setting contents for selecting the communication method can be stored in advance.

When the encrypted terminal ID and the encryption parameter are read out simultaneously and copied, forgery becomes possible. Therefore, it is desirable to arrange in the file so that the relationship between the encrypted terminal ID and the encryption parameter is not known. For example, in order not to make an analogy with the relationship with the encrypted terminal ID, the following methods (1) to (4) may not be used to place them at consecutive positions.
(1) As a part of setting items, for example, item 2 of the setting item is not a setting item of the mobile terminal but an encryption parameter.
(2) A dummy item is inserted in the first 3 bytes of the encryption parameter item, and the encryption parameter is acquired from the fourth byte of the specified item.
(3) Put the number of bytes of the dummy item in the first byte of the encryption parameter so that the dummy byte can be changed each time.
(4) As for the encryption parameter, what number of setting items is put in the encryption parameter item, and the regular encryption parameter is actually put in the smartphone setting item of the number specified in the encryption parameter item. .

  Referring to FIG. 3, in step S <b> 303, the mobile terminal 100 starts a mobile terminal setting application. The portable terminal setting application communicates with the non-contact IC 202 through subsequent steps, reads the parameters in the file stored in the storage unit 206 of the non-contact IC, and stores the read parameters in the storage unit of the portable terminal. It is an application that sets a mobile terminal by storing, or activates another application of the mobile terminal using the read parameters.

  In step S305, the read / write unit 104 of the mobile terminal 100 starts detecting the non-contact IC 202 for setting the mobile terminal (starts detecting the non-contact IC card including the non-contact IC in which the setting file is stored). ).

  When a non-contact IC is detected in step S307, the processor 102 (mobile terminal setting application) of the mobile terminal is a non-contact IC for mobile terminal setting based on the contents of the file stored in the non-contact IC in step S309. Determine whether or not.

  When a non-contact IC is not detected (S307) or when it is determined that the non-contact IC is not a portable terminal setting non-contact IC (S309), the process returns to step S305, and detection of the portable terminal setting non-contact IC is continued.

  When it is determined that it is a non-contact IC for mobile terminal setting (step S309), in step S311, the processor 102 (mobile terminal setting application) of the mobile terminal encrypts the terminal ID encrypted from the storage unit 206 of the non-contact IC. And read the encryption parameter (random number). Next, in step 311, the processor 102 (mobile terminal setting application) of the mobile terminal decrypts the terminal ID encrypted using the read encryption parameter and decryption key.

  In step S315, the processor 102 (mobile terminal setting application) of the mobile terminal determines whether the decrypted terminal ID matches the terminal ID acquired from the SIM 103 or the storage unit 106 of the mobile terminal. If it is determined that they do not match, in step S327, an error is displayed on the display unit 112, and the process is completed.

  When it is determined that they match (S315). In step S317, the processor 102 (mobile terminal setting application) of the mobile terminal reads the setting parameter from the storage unit 206 of the non-contact IC. Next, in step 319, the processor 102 (mobile terminal setting application) of the mobile terminal sets the mobile terminal 100 according to the read setting parameter. For example, the read setting parameter is stored in the storage unit 106, or another application is started and executed using the read setting parameter.

  In step S321, the processor 102 (mobile terminal setting application) of the mobile terminal changes the encryption parameter. In step 323, the terminal ID is encrypted using the changed encryption parameter and encryption key.

  In step S325, the processor 102 (mobile terminal setting application) of the mobile terminal writes the changed encryption parameter and the encrypted terminal ID in the storage unit 206 of the non-contact IC. As described in (3) above, when the first byte of the encryption parameter is changed, the processor 102 (mobile terminal setting application) of the mobile terminal changes the dummy byte, and the changed dummy byte is used as a non-contact IC. To the storage unit 206.

(Embodiment 2)
Next, a mobile terminal setting method according to the second embodiment will be described with reference to FIG. In the present embodiment, it is assumed that the non-contact IC 202 has a processor or encryption device 208. Files shown in Table 3 are stored in the storage unit 206 of the non-contact IC 202 in advance. As shown in Table 3, the file contains authentication information (terminal ID of the portable terminal) used for authentication between the portable terminal 100 and the non-contact IC 204, and the processor or the encryption device 208 encrypts the terminal ID. Encryption information (encryption key) and encryption parameters are stored. The encryption parameter is a parameter that is added to the terminal ID and encrypted together with the terminal ID, and may be optionally set. The encryption parameter can be an initial value of encryption or the number of times of encryption. The encryption parameter is synchronized and shared between the mobile terminal 100 and the contactless IC 202 for each authentication. The mobile terminal 100 and the non-contact IC 202 may update and hold the encryption parameter (the number of encryptions) each time authentication is performed.

  Further, the encryption parameter may be arranged in a file so that the relevance between the encrypted terminal ID and the encryption parameter is not determined by the methods (1) to (4) described above.

  Further, similarly to the example shown in Table 1, the file in Table 3 can store in advance settings for the volume of the mobile terminal, the time when the alarm is generated, and the selection of the communication method, for example.

  Referring to FIG. 4, steps S403 to S409 correspond to steps S303 to S309 in FIG.

  When it is determined that the contactless IC is for mobile terminal setting (step S409), in step S411, the processor 102 (mobile terminal setting application) of the mobile terminal generates a random number. The random number is a processing parameter for processing the terminal ID. The processing parameter is not limited to a random number, and may be a value that changes each time. For example, a time stamp may be used.

  In step 413, the processor 102 (mobile terminal setting application) of the mobile terminal performs an XOR operation between the generated random number and the terminal ID acquired from the SIM 103 or the storage unit 106 of the mobile terminal, and the XOR value (first XOR value) (Also called).

  In step 415, the processor 102 (mobile terminal setting application) of the mobile terminal transmits the calculated XOR value to the non-contact IC 202. The XOR value may be encrypted using an encryption key and sent.

  In step 417, the processor 208 of the non-contact IC performs an XOR operation between the XOR value received from the mobile terminal 100 and the terminal ID stored in the storage unit 206, and the processor 102 of the mobile terminal uses the XOR operation ( Find a random number. Further, the processor 208 of the non-contact IC performs an XOR operation between the random number and the terminal ID stored in the storage unit 206 to calculate an XOR value (also referred to as a second XOR value). Thereafter, the second XOR value is encrypted using an encryption key (optionally, an encryption parameter) stored in the storage unit 206.

  In step 419, the non-contact IC 202 transmits the encrypted second XOR value to the mobile terminal 100.

  In step 421, the processor 102 (portable terminal setting application) of the mobile terminal decrypts the second XOR value encrypted by the non-contact IC 202.

  In step 423, the processor 102 (portable terminal setting application) of the portable terminal performs an XOR operation of the random number generated in step 411 and the second XOR value decoded in step 421, and performs the third XOR value (in step 417). The terminal ID used by the non-contact IC processor 208 in the XOR operation (estimated) is obtained.

  In step 425, the processor 102 (portable terminal setting application) of the mobile terminal is estimated to have used the third XOR value obtained in step 423 (the non-contact IC processor 208 used to obtain the second XOR value). ID) and the terminal ID used in step 413 (the terminal ID stored in the portable terminal used for obtaining the first XOR value) are determined. If it is determined that they do not match, in step S431, an error is displayed on the display unit 112, and the process is completed.

  When it is determined that they match (S425). In step S427, the processor 102 (mobile terminal setting application) of the mobile terminal reads the setting parameter from the storage unit 206 of the non-contact IC.

  In step 429, the processor 102 (mobile terminal setting application) of the mobile terminal sets the mobile terminal 100 according to the read setting parameter. For example, the read setting parameter is stored in the storage unit 106, or another application is started and executed using the read setting parameter.

(Embodiment 3)
In the above-described embodiment, an example in which the storage unit of the non-contact IC stores a setting file including a set of setting contents related to one portable terminal has been described (Tables 2 and 3). However, the setting file stored in the storage unit of the non-contact IC is not limited to this.

  A non-contact IC card for setting a mobile terminal has a plurality of mobile terminal device IDs to be set and a plurality of setting areas, whereby a plurality of configuration terminals are set differently with a single non-contact IC card. It becomes possible to set to.

  Table 4 shows an example of the setting file stored in the storage unit of the non-contact IC having a plurality of setting areas.

  In the example of Table 4, the terminal ID of one portable terminal is given as portable terminal information for each setting area. However, as shown in Table 5, the range of terminal IDs as portable terminal information is set in one setting area. The same setting may be specified for a plurality of terminals. Alternatively, as shown in Table 6, a plurality of terminal IDs may be listed in one setting area and the same setting may be set for a plurality of terminals.

  Tables 4 to 6 show examples in which each setting area stores the same setting contents as in Table 3, but each setting area may store the same setting contents as in Table 2.

(Embodiment 4)
If the setting items (setting parameters) described in the storage unit of the non-contact IC for setting the mobile terminal are tampered with, malicious content even if security such as authentication between the mobile terminal and the non-contact IC is applied There is a risk of being rewritten. Therefore, it is possible to further increase security by performing the following measures together.

  (A) Not only the encryption of the terminal ID for authentication, but also the setting contents (setting parameters) described in the setting items of the portable terminal are encrypted.

  (B) An access authority is added when setting contents (setting parameters) are written to a file in the storage unit of the non-contact IC. For example, passwords and the like are collated, and setting contents cannot be registered or updated unless the collation is successful.

  With reference to FIG. 5, a flow for writing setting contents (setting parameters) to a file in a storage unit of a non-contact IC for mobile terminal setting will be described. Steps S503 to S509 correspond to steps S303 to S309 in FIG.

  When the processor 102 (mobile terminal setting application) of the mobile terminal determines in step S509 that the mobile terminal setting non-contact IC is used, the processor 102 (mobile terminal setting application) of the mobile terminal sets the password in step S511. Match. For example, a password input form is displayed on the display unit 112, and the password input from the input unit 110 is compared with the password stored in the storage unit 106 or the storage unit 206. If the password verification is not successful, in step S517, an error is displayed on the display unit 112, and the process is completed.

  If the password verification is successful, the processor 102 (mobile terminal setting application) of the mobile terminal writes the setting parameter in the storage unit 206 of the non-contact IC.

  As described above, falsification of setting items (setting parameters) described in the storage unit of the non-contact IC can be prevented.

100 Mobile devices (mobile phones, smartphones, multi-function mobile phones)
102 processor 104 read / write unit 106 storage unit 108 operation unit 110 input unit 112 display unit 114 communication unit 116 antenna 150 wireless network 200 contactless IC card 202 contactless IC
204 Communication unit 206 Storage unit 208 Processor

Claims (11)

A portable terminal setting method for setting a portable terminal using a communication function with a non-contact IC for setting a portable terminal, wherein the portable terminal stores unique authentication information, and the non-contact IC is a setting parameter. And authentication information specific to the mobile terminal that sets the setting parameter, and the mobile terminal setting method includes:
The mobile terminal performs authentication based on authentication information stored in the mobile terminal and authentication information stored in the contactless IC;
And a step of setting the portable terminal in accordance with the setting parameter from the non-contact IC when the authentication is successful. The authentication information stored in the non-contact IC is encrypted and stored using an encryption parameter,
The step of performing the authentication includes:
The mobile terminal receiving and decrypting the encryption parameter and the encrypted authentication information from the contactless IC;
The mobile terminal setting method according to claim 1, further comprising: comparing the decrypted authentication information with authentication information stored in the mobile terminal. The portable terminal according to claim 1, further comprising a step of encrypting authentication information stored in the portable terminal using the encryption parameter and storing the encrypted information in the contactless IC. Setting method. The mobile terminal setting method according to claim 3, further comprising the step of the mobile terminal changing the encryption parameter before encrypting the authentication information stored in the mobile terminal.   The mobile terminal setting according to any one of claims 1 to 4, wherein the encrypted authentication information and the encryption parameter are stored at non-contiguous positions in a storage area of the contactless IC. Method. The step of performing the authentication includes:
The portable terminal generating a first processing parameter;
The portable terminal transmitting a first processing value obtained by computing the authentication information stored in the portable terminal and the first processing parameter to the non-contact IC;
The portable terminal is stored in the non-contact IC and the second processing parameter obtained by the arithmetic processing of the first processing value by the non-contact IC and the authentication information stored in the non-contact IC. Receiving a second processing value obtained by the arithmetic processing with authentication information;
Does the portable terminal match the third processing value obtained by the calculation process of the first processing parameter and the second processing value and the authentication information stored in the portable terminal? The mobile terminal setting method according to claim 1, further comprising the step of:   The mobile terminal setting method according to claim 6, wherein the calculation process is an XRO calculation.   The mobile terminal setting method according to claim 6 or 7, wherein the first processing parameter is a random number. Before transmitting the first processing value to the contactless IC, the portable terminal encrypts the first processing value;
The second processing value is encrypted by the contactless IC, and the portable terminal includes a step of decrypting the encrypted second processing value. The mobile terminal setting method according to any one of 8.   A program for causing a processor of a mobile terminal provided with means for communicating with a non-contact IC for setting a mobile terminal to execute the mobile terminal setting method according to any one of claims 1 to 9.   A portable terminal comprising a communication means with a non-contact IC for setting a portable terminal, a storage means, and a processor, wherein the storage means uses the portable terminal setting method according to any one of claims 1 to 9. A portable terminal in which a program to be executed by a processor is recorded.

Images